agenttesla | 7d6bb1dd17997b0bd5f1aedbead104c6022e6ffc2f8e6a9716c7fb8c87e72a08

General

Target

Ticari Hesap Özetiniz.exe
Size

566KB
MD5

8e05981832709c9e00586b10c0481ea9
SHA1

7968e6db47a3815025563afb2d9c12ea893d47e5
SHA256

7d6bb1dd17997b0bd5f1aedbead104c6022e6ffc2f8e6a9716c7fb8c87e72a08
SHA512

952b14edcd4fda18c7a6b853f5e88986795ceb7e74ae97d4c143420eb84c36287d83656436011a310837486e9440c708bbde1b25a04bc58a2e67d77d06b25262

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.hospitalveterinariosur.com
Port:
587
Username:
[email protected]
Password:
HospitalVeterinarioAlSur2018

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1368-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1368-1-0x000000000044C8DE-mapping.dmp	family_agenttesla
behavioral1/memory/1368-2-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1368-3-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Ticari Hesap Özetiniz.exe

description pid process target process

PID 904 set thread context of 1368 904 Ticari Hesap Özetiniz.exe Ticari Hesap Özetiniz.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Ticari Hesap Özetiniz.exeTicari Hesap Özetiniz.exe

pid process

904 Ticari Hesap Özetiniz.exe
904 Ticari Hesap Özetiniz.exe
1368 Ticari Hesap Özetiniz.exe
1368 Ticari Hesap Özetiniz.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Ticari Hesap Özetiniz.exeTicari Hesap Özetiniz.exe

description pid process

Token: SeDebugPrivilege 904 Ticari Hesap Özetiniz.exe
Token: SeDebugPrivilege 1368 Ticari Hesap Özetiniz.exe

description	pid	process	target process
PID 904 set thread context of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe

pid	process
904	Ticari Hesap Özetiniz.exe
904	Ticari Hesap Özetiniz.exe
1368	Ticari Hesap Özetiniz.exe
1368	Ticari Hesap Özetiniz.exe

description	pid	process
Token: SeDebugPrivilege	904	Ticari Hesap Özetiniz.exe
Token: SeDebugPrivilege	1368	Ticari Hesap Özetiniz.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Ticari Hesap Özetiniz.exeTicari Hesap Özetiniz.exe

description	pid	process	target process
PID 904 wrote to memory of 1672	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1672	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1672	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1672	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1356	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1356	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1356	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1356	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 904 wrote to memory of 1368	904	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 1368 wrote to memory of 1340	1368	Ticari Hesap Özetiniz.exe	netsh.exe
PID 1368 wrote to memory of 1340	1368	Ticari Hesap Özetiniz.exe	netsh.exe
PID 1368 wrote to memory of 1340	1368	Ticari Hesap Özetiniz.exe	netsh.exe
PID 1368 wrote to memory of 1340	1368	Ticari Hesap Özetiniz.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz.exe
"C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz.exe
"{path}"
2⤵
PID:1672

C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz.exe
"{path}"
2⤵
PID:1356

C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:1340

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-4-0x0000000000000000-mapping.dmp

Download
memory/1368-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1368-1-0x000000000044C8DE-mapping.dmp

Download
memory/1368-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1368-3-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing